CVE-2026-37221
FlexRIC v2.0.0 Assertion Failure via RIC_SUBSCRIPTION_RESPONSE
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mosaic5g | flexric | 2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not include any details on how CVE-2026-37221 affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-37221 affects FlexRIC version 2.0.0 and causes the near-RT RIC component to crash when it receives a forged RIC_SUBSCRIPTION_RESPONSE containing an unknown ric_id that does not correspond to any pending event.
The vulnerability arises because the response handler attempts to stop a pending event using the ric_id without verifying if such an event exists. This leads to an assertion failure in debug builds (SIGABRT) or a null pointer dereference in release builds (SIGSEGV), causing the application to crash.
A remote unauthenticated attacker can exploit this by sending a malformed RIC_SUBSCRIPTION_RESPONSE over SCTP to port 36421, triggering the crash.
How can this vulnerability impact me? :
This vulnerability can cause the near-RT RIC component of FlexRIC to crash unexpectedly, leading to denial of service conditions.
An attacker who exploits this flaw can disrupt the normal operation of the system by sending forged subscription responses, potentially affecting availability and stability.
Since the attacker can be remote and unauthenticated, the risk of exploitation is higher if the SCTP port 36421 is exposed or accessible by untrusted entities.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unexpected crashes of the FlexRIC v2.0.0 near-RT RIC process, especially crashes caused by SIGABRT or SIGSEGV signals when receiving RIC_SUBSCRIPTION_RESPONSE messages.
To detect exploitation attempts on your network, you can capture and analyze SCTP traffic on port 36421 for malformed or forged RIC_SUBSCRIPTION_RESPONSE messages containing unknown ric_id values.
Suggested commands include using packet capture tools like tcpdump or tshark to filter SCTP traffic on port 36421:
- tcpdump -i <interface> port 36421 and sctp
- tshark -i <interface> -f "port 36421 and sctp" -V
Additionally, monitoring system logs for process crashes or core dumps related to the near-RT RIC service can help identify if the vulnerability has been triggered.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting SCTP access to port 36421 on the near-RT RIC to trusted E2 nodes only, effectively limiting the attack surface.
Since no upstream fix was available at the time of disclosure, network-level controls such as firewall rules or SCTP filtering should be applied to block unauthorized or untrusted sources from sending RIC_SUBSCRIPTION_RESPONSE messages.
Monitoring and alerting on unexpected crashes of the near-RT RIC process can also help in early detection and response.